TaintedSql

User-controlled input reaches a SQL sink without parameterization, creating a SQL injection risk.

Example

<?php
$id = $_GET['id'];
$db->query("SELECT * FROM users WHERE id = $id"); // injection risk

How to fix

Use prepared statements with bound parameters.

<?php
$stmt = $db->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$_GET['id']]);